What this requirement asks
Limit access to CUI on system media to authorized users.
This is a CMMC Level 2 requirement in the Media Protection family, drawn from NIST SP 800-171 Rev. 2. An assessor evaluates it objective by objective — every objective below must be supported by evidence, not just described in a policy.
Assessment objectives (1)
- 3.8.2[a] — access to CUI on system media is limited to authorized users
What an assessor examines
Examine:
- System media protection policy
- procedures addressing media storage
- physical and environmental protection policy and procedures
- access control policy and procedures
- system security plan
- system media
- designated controlled areas
- other relevant documents or records
Interview:
- Personnel with system media protection and storage responsibilities
- personnel with information security responsibilities
Test:
- Organizational processes for storing media
- mechanisms supporting or implementing secure media storage and media protection
Evidence that defends it
Access logs and physical controls evidence
Check your readiness
Score this requirement against your own environment with the Level 2 self-assessment checklist, or estimate your SPRS score with the free CMMC compliance tool. Self-reported answers are planning signals only — they do not establish a verified or assessor-accepted result.